ashlr-plugin
Multi-host AI coding efficiency layer for Codex and Claude Code, powered by @ashlr/core-efficiency.
This report shows the evidence for ashlr-plugin@1.38.0. 0 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2h ago · by lpm-firewall-aiThe package documents telemetry as opt-in and off by default, yet the upgrade-nudge path uploads event metadata whenever a Pro token is available unless a separate kill switch is set. The payload is limited and goes to the package's own service, so this is suspicious undisclosed telemetry rather than data exfiltration.
Static reason
One or more suspicious static signals were detected.
Trigger
The savings status line displays the upgrade nudge while a Pro token is available.
Impact
The Ashlr service receives hashed session identifiers and upgrade-nudge event metadata by default for Pro-token users, contrary to the documented opt-in telemetry posture.
Mechanism
It reads locally recorded nudge events and posts them with a Bearer token to ASHLR_API_URL, defaulting to https://api.ashlr.ai. ASHLR_STATS_UPLOAD=0 disables the upload, but ASHLR_TELEMETRY is not checked.
AI rationale
The package documents telemetry as opt-in and off by default, yet the upgrade-nudge path uploads event metadata whenever a Pro token is available unless a separate kill switch is set. The payload is limited and goes to the package's own service, so this is suspicious undisclosed telemetry rather than data exfiltration.
Evidence
README.mddocs/telemetry.mdscripts/savings-status-line.tsservers/_nudge-events.ts~/.ashlr/nudge-events.jsonl~/.ashlr/nudge-session-state.json
Network endpoints2
api.ashlr.ai/events/nudgeASHLR_API_URL/events/nudge
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The README and telemetry guide describe telemetry as opt-in and off by default.
- The savings status line records an upgrade-nudge event and calls the cloud sync without checking ASHLR_TELEMETRY.
- The sync requires a Pro token, has an ASHLR_STATS_UPLOAD=0 opt-out, and posts events to the configured API, defaulting to api.ashlr.ai.
- Nudge events contain a hashed session ID, bucketed token count, event type, variant, and nudge ID; they do not include prompts or file contents.
Evidence against
- The nudge telemetry is limited to event metadata and bucketed counts.
- The separate audit-upload hook is described as Pro-tier audit logging sent to the Ashlr backend.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggedhooks/pulse-emit.tsView file
33import { createHash } from "crypto";
L34: import { spawnSync } from "child_process";
L35:
High
Child Process
Package source references child process execution.
hooks/pulse-emit.tsView on unpkg · L33hooks/pretooluse-budget-guard.tsView file
168try {
L169: const { appendFileSync, mkdirSync } = require("fs");
L170: const { dirname } = require("path");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
hooks/pretooluse-budget-guard.tsView on unpkg · L168scripts/upgrade-flow.tsView file
26import { join } from "path";
L27: import { spawn } from "child_process";
L28: import * as readline from "readline";
...
L37:
L38: const API_URL = process.env["ASHLR_API_URL"] ?? "https://api.ashlr.ai";
L39: const SITE_URL = process.env["ASHLR_SITE_URL"] ?? "https://plugin.ashlr.ai";
Findings
5 High6 Medium4 Low
HighChild Processhooks/pulse-emit.ts
HighShell
HighSame File Env Network Executionscripts/upgrade-flow.ts
HighSandbox Evasion Gated Capabilityscripts/ollama-setup.ts
HighSemantic Analysis Limitedservers/github-server.ts#virtual:string-array:round1
MediumDynamic Requirehooks/pretooluse-budget-guard.ts
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbench/refs/python-lib/pandas/core/accessor.py
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to ashlr-plugin@1.38.0.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of ashlr-plugin@1.38.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.